Device and method for detecting command and control channel

Abstract

A device for detecting a command and control channel includes: a session log collector for collecting log information of sessions generated between at least one communication device of the first network and at least one communication device of the second network; an analyzer for generating test data for respective sessions based on the log information, and calculating a test data distribution based on test data of the sessions; and a determiner for extracting a test data value corresponding to an abnormal distribution from the test data distribution based on an abnormal distribution determination standard, and estimating sessions relating to the extracted test data value as a command and control channel.

Description

TECHNICAL FIELD[0001]The present invention relates to a device and method for detecting a command and control channel.BACKGROUND ART[0002]Recently, various sorts of target attacks such as a denial of service (DoS) attack, personal information hacking, financial agencies hacking, and cyber terrors have been increasing, starting from the distributed denial of service (DoS) attack. There are various kinds of attackers and attacking methods, and a common ground thereof is that an external part of a network to be attacked and is connected to an internal part of the network to be attacked by a command and control channel and the attack is performed.[0003]The attack through the command and control channel represents an advanced persistent attack. An attacker stays with the network to be attacked for several months, collecting information, attacking the internal network, destroying the system, and hacking information. The network to be attacked is generally protected by a firewall or an int...

AI Technical Summary

Benefits of technology

The present invention allows for analyzing communication sessions to detect malicious access. This can help identify attacks without a signature and can also help with detecting gradual and precise attacks on an internal network. Additionally, the invention can detect modified attacks or encrypted traffic, regardless of the method used for the attack.

Problems solved by technology

An attacker stays with the network to be attacked for several months, collecting information, attacking the internal network, destroying the system, and hacking information.

In particular, recently, the command and control channel has not been maintained, but the internal network device contaminated by the attacker periodically attempts access to the attacker provided on the outer side to generate a command and control channel.

However, such detecting method detects known malicious behavior so it only detects low-level attacks for copying already used attacking methods and has a difficulty in detecting attacks using new command and control channels.

Images